> ## Documentation Index
> Fetch the complete documentation index at: https://docs.didit.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Business Status

> Flip only the lifecycle `status` of a business — VendorBusinessStatusChoices (`ACTIVE`/`FLAGGED`/`BLOCKED`, NOT session statuses). `BLOCKED` adds `vendor_data` to the system blocklist.

export const AgentPromptAccordion = ({prompt, title = "AI Agent Integration Prompt"}) => {
  const [copied, setCopied] = React.useState(false);
  const handleCopy = e => {
    e.stopPropagation();
    if (!prompt) return;
    navigator.clipboard.writeText(prompt.trim()).then(() => {
      setCopied(true);
      setTimeout(() => setCopied(false), 2000);
    });
  };
  const agents = ["Claude Code", "Codex", "Cursor", "Devin", "Windsurf", "GitHub Copilot"];
  return <div className="didit-agent-card">
      {}
      <div className="didit-agent-titlebar">
        <div className="didit-agent-dots" aria-hidden="true">
          <span className="didit-agent-dot didit-agent-dot-red"></span>
          <span className="didit-agent-dot didit-agent-dot-yellow"></span>
          <span className="didit-agent-dot didit-agent-dot-green"></span>
        </div>
        <span className="didit-agent-filename">{title}</span>
        <button type="button" className={`didit-agent-copy ${copied ? "didit-agent-copy-copied" : ""}`} onClick={handleCopy} title="Copy prompt to clipboard" aria-label={copied ? "Copied!" : "Copy prompt to clipboard"}>
          {copied ? <>
              <svg width="13" height="13" viewBox="0 0 16 16" fill="none">
                <path d="M3 8.5l3.5 3.5L13 4" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" />
              </svg>
              <span>Copied</span>
            </> : <>
              <svg width="13" height="13" viewBox="0 0 16 16" fill="none">
                <rect x="5" y="5" width="9" height="9" rx="1.5" stroke="currentColor" strokeWidth="1.5" />
                <path d="M11 5V3.5A1.5 1.5 0 0 0 9.5 2h-6A1.5 1.5 0 0 0 2 3.5v6A1.5 1.5 0 0 0 3.5 11H5" stroke="currentColor" strokeWidth="1.5" />
              </svg>
              <span>Copy</span>
            </>}
        </button>
      </div>

      {}
      <pre className="didit-agent-body"><code>{prompt.trim()}</code></pre>

      {}
      <div className="didit-agent-footer">
        <span className="didit-agent-footer-label">Paste into</span>
        <div className="didit-agent-chips">
          {agents.map(name => <span key={name} className="didit-agent-chip">{name}</span>)}
        </div>
      </div>
    </div>;
};

<AgentPromptAccordion
  title="Update Business Status Prompt"
  prompt={`Goal: Flip ONLY the lifecycle status of a Didit Business (KYB) entity. Use the full PATCH /v3/businesses/{vendor_data}/ when you also need to touch other fields.

Endpoint: PATCH https://verification.didit.me/v3/businesses/{vendor_data}/update-status/
Auth header: x-api-key: <DIDIT_API_KEY>
Content-Type: application/json

Path param:
- vendor_data (string, REQUIRED) — free-form string, NOT a UUID. URL-encode.

Request body:
- status (enum, REQUIRED) — "ACTIVE" | "FLAGGED" | "BLOCKED" (VendorBusinessStatusChoices, NOT the session enum).

Status semantics:
- ACTIVE  → normal. New KYB sessions allowed for this vendor_data.
- FLAGGED → still accepted, highlighted in Console for manual review; filterable with ?status=FLAGGED.
- BLOCKED → terminal. Adds vendor_data to the system blocklist. Subsequent KYB session creations for the same identifier are rejected. Flipping back to ACTIVE/FLAGGED removes the blocklist entry automatically.

curl:
curl -X PATCH 'https://verification.didit.me/v3/businesses/company-123/update-status/' \\
-H 'x-api-key: YOUR_API_KEY' \\
-H 'Content-Type: application/json' \\
-d '{"status": "BLOCKED"}'

Response 200: full updated BusinessDetailItem (same shape as GET /v3/businesses/{vendor_data}/). See /reference/data-models.

Side effects:
- Toggles the system blocklist entry when entering/leaving BLOCKED.
- Writes one entry to the business's comments activity log (actor = API key identity).
- Idempotent — re-sending the same status is a no-op (no extra audit row, no extra blocklist toggle).

Failure modes:
- 400 — validation:
{ "status": "This field is required." }
{ "status": "Invalid status. Valid options are: ACTIVE, FLAGGED, BLOCKED" }
- 401 — missing/invalid x-api-key.
- 403 — lacks update-status:businesses.
- 404 — vendor_data not found (or soft-deleted). { "detail": "Not found." }
- 429 — rate-limited.

For end-to-end Didit integration, paste in the full prompt at /integration/integration-prompt.`}
/>

## Overview

Moves a [Business entity](/entities/businesses/overview) between `ACTIVE`, `FLAGGED`, and `BLOCKED`. See [entity lifecycle](/entities/lifecycle) for the full state machine.

## When to use it

* **Block** a sanctioned or confirmed-fraudulent business.
* **Flag** a business pending manual review.
* **Unblock** after remediation.
* **Propagate external signals** from your own compliance systems.

## Notes

* Valid values: `ACTIVE`, `FLAGGED`, `BLOCKED`.
* Passing a `reason` string is recommended — it is persisted and surfaced in the audit log and webhook payload.
* `BLOCKED` businesses have all new Business Verification (KYB) sessions auto-declined and all new transactions auto-declined, including when they appear as counterparty.
* Emits `business.status.updated` with `previous_status`, `status`, and `reason`.

## Enforcement

| Status    | New Business Verification (KYB) sessions | Transactions involving this business |
| --------- | ---------------------------------------- | ------------------------------------ |
| `ACTIVE`  | Normal flow                              | Normal flow                          |
| `FLAGGED` | Routed to `IN_REVIEW`                    | May auto-escalate via rules          |
| `BLOCKED` | Auto-declined                            | Auto-declined                        |

## Permissions

Role must grant `update-status:businesses`.

## Related

* [Entity lifecycle](/entities/lifecycle)
* [Business blocklist](/entities/businesses/blocklist)
* [Entity webhooks](/entities/webhooks)


## OpenAPI

````yaml PATCH /v3/businesses/{vendor_data}/update-status/
openapi: 3.0.0
info:
  version: 3.0.0
  title: Didit Verification API
  description: Identity verification API. Authenticate with x-api-key header.
servers:
  - url: https://verification.didit.me
security: []
tags: []
paths:
  /v3/businesses/{vendor_data}/update-status/:
    patch:
      tags:
        - Businesses
      summary: Update business status
      description: >-
        Flip only the lifecycle `status` of a business —
        VendorBusinessStatusChoices (`ACTIVE`/`FLAGGED`/`BLOCKED`, NOT session
        statuses). `BLOCKED` adds `vendor_data` to the system blocklist.
      operationId: update_business_status
      parameters:
        - name: vendor_data
          in: path
          required: true
          schema:
            type: string
          description: >-
            Your unique identifier for the business (free-form string, NOT a
            UUID).
          example: company-123
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - status
              properties:
                status:
                  type: string
                  enum:
                    - ACTIVE
                    - FLAGGED
                    - BLOCKED
                  description: >-
                    New lifecycle status. `BLOCKED` also adds the `vendor_data`
                    to the system blocklist.
            examples:
              Flag:
                summary: Flag the business for review
                value:
                  status: FLAGGED
              Block:
                summary: Block the business (adds to system blocklist)
                value:
                  status: BLOCKED
              Reactivate:
                summary: Reactivate the business
                value:
                  status: ACTIVE
      responses:
        '200':
          description: Business status updated. Full business record returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BusinessDetailItem'
              examples:
                Blocked:
                  value:
                    didit_internal_id: a1b2c3d4-e5f6-4890-abcd-ef1234567890
                    vendor_data: company-123
                    display_name: null
                    legal_name: Acme Trading Ltd
                    registration_number: '12345678'
                    country_code: GB
                    effective_name: Acme Trading Ltd
                    status: BLOCKED
                    session_count: 2
                    approved_count: 1
                    declined_count: 0
                    in_review_count: 1
                    features:
                      KYB: Approved
                    features_list:
                      - feature: KYB
                        status: Approved
                    last_session_at: '2026-03-15T10:30:00Z'
                    last_activity_at: '2026-03-15T10:30:00Z'
                    first_session_at: '2026-01-10T08:00:00Z'
                    tags:
                      - uuid: 9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d
                        name: VIP
                        color: '#2567FF'
                    created_at: '2026-01-10T08:00:00Z'
                    metadata:
                      industry: fintech
                    updated_at: '2026-03-15T10:30:00Z'
        '400':
          description: Missing or invalid `status`.
          content:
            application/json:
              examples:
                Missing status:
                  value:
                    status:
                      - This field is required.
                Bad status:
                  value:
                    status:
                      - >-
                        Invalid status. Valid options are: ACTIVE, FLAGGED,
                        BLOCKED
        '403':
          description: >-
            Missing, invalid, or revoked API key, or the key cannot update
            businesses for this application. This endpoint returns `403` (never
            `401`) for authentication failures, including requests with no
            credentials at all.
          content:
            application/json:
              examples:
                Forbidden:
                  value:
                    detail: You do not have permission to perform this action.
        '404':
          description: >-
            No (non-deleted) business with the supplied `vendor_data` exists for
            this application.
          content:
            application/json:
              examples:
                Not found:
                  value:
                    detail: Not found.
        '429':
          description: >-
            Rate limit exceeded; back off and retry after the interval indicated
            in `Retry-After`.
          content:
            application/json:
              examples:
                Rate limited:
                  value:
                    detail: Request was throttled. Expected available in 30 seconds.
      security:
        - ApiKeyAuth: []
      x-codeSamples:
        - lang: curl
          label: curl
          source: >-
            curl -X PATCH
            'https://verification.didit.me/v3/businesses/company-123/update-status/'
            \
              -H 'x-api-key: YOUR_API_KEY' \
              -H 'Content-Type: application/json' \
              -d '{"status": "BLOCKED"}'
        - lang: python
          label: Python
          source: |-
            import requests

            resp = requests.patch(
                'https://verification.didit.me/v3/businesses/company-123/update-status/',
                headers={'x-api-key': 'YOUR_API_KEY', 'Content-Type': 'application/json'},
                json={'status': 'BLOCKED'},
            )
            resp.raise_for_status()
            print(resp.json()['status'])
        - lang: javascript
          label: JavaScript
          source: >-
            const resp = await
            fetch('https://verification.didit.me/v3/businesses/company-123/update-status/',
            {
              method: 'PATCH',
              headers: { 'x-api-key': process.env.DIDIT_API_KEY, 'Content-Type': 'application/json' },
              body: JSON.stringify({ status: 'BLOCKED' }),
            });

            const biz = await resp.json();

            console.log(biz.status);
components:
  schemas:
    BusinessDetailItem:
      type: object
      description: >-
        Full business detail. Extends BusinessListItem with metadata and
        updated_at.
      allOf:
        - $ref: '#/components/schemas/BusinessListItem'
        - type: object
          properties:
            metadata:
              type: object
              description: >-
                Custom metadata JSON you attached to this business. Defaults to
                `{}`.
            updated_at:
              type: string
              format: date-time
    BusinessListItem:
      type: object
      description: A verified business.
      properties:
        didit_internal_id:
          type: string
          format: uuid
          description: Didit's stable internal UUID for this business.
        vendor_data:
          type: string
          nullable: true
          description: >-
            Your unique identifier for this business (passed when creating
            sessions). This can be null when no vendor identifier was supplied.
        display_name:
          type: string
          nullable: true
          description: Custom display name set by you
        legal_name:
          type: string
          nullable: true
          description: Official legal name from registry or manual entry
        registration_number:
          type: string
          nullable: true
          description: Company registration or incorporation number
        country_code:
          type: string
          nullable: true
          description: Country of incorporation (ISO 3166-1 alpha-2, e.g. `GB`, `US`).
        effective_name:
          type: string
          nullable: true
          description: 'Best available name: display_name if set, otherwise legal_name'
        status:
          type: string
          enum:
            - ACTIVE
            - FLAGGED
            - BLOCKED
          description: >-
            Lifecycle status of the business record (NOT a session status).
            `ACTIVE` is the default, `FLAGGED` marks it for manual attention,
            `BLOCKED` prevents new sessions for this `vendor_data`.
        session_count:
          type: integer
          description: Total number of verification sessions for this business
        approved_count:
          type: integer
          description: Number of approved sessions
        declined_count:
          type: integer
          description: Number of declined sessions
        in_review_count:
          type: integer
          description: Number of sessions in review
        features:
          type: object
          description: >-
            Aggregated per-feature status across all of this business's KYB
            sessions. Currently the only key is `KYB` (the registry company
            check status). Possible values: `Approved`, `Declined`, `In Review`,
            `Not Finished`, `Resub Requested`.
        features_list:
          type: array
          items:
            type: object
            properties:
              feature:
                type: string
              status:
                type: string
          description: >-
            Same data as `features`, as an ordered array of `{feature, status}`
            objects.
        last_session_at:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the most recent session
        first_session_at:
          type: string
          format: date-time
          nullable: true
          description: Timestamp of the first session
        last_activity_at:
          type: string
          format: date-time
          nullable: true
          description: >-
            Timestamp of the most recent activity (status change, session
            update, etc.)
        tags:
          type: array
          items:
            type: object
            properties:
              uuid:
                type: string
                format: uuid
              name:
                type: string
              color:
                type: string
          description: Tags assigned to this business
        created_at:
          type: string
          format: date-time
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key

````